fields @timestamp, @message
| filter @message like 'Request executed successfully'
# {"context":{"accountId":"781754","appId":"7656","msg":"Request executed successfully","timestamp":"2022-07-06 06:32:23.552","uuid":"a16e8644-ebae-4d2d-a58c-246ecb39adbb"}
| parse @message '*accountId":"*","appId":"*",*' as prefix, accountId, appId, postFix
| sort @timestamp desc
| stats count(*) by accountId
Created
July 6, 2022 06:39
-
-
Save ghsatpute/d6ab23aa5040ad5ae42da870dae4769d to your computer and use it in GitHub Desktop.
How to parse logs from CloudWatch Logs Insights
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment